All vulnerabilities
CVE-2026-105140GHSA-929v-v9hq-5xhr

Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 Race Condition Restores Revoked Group Membership

obot-platform obot
Open in ThreatlineRecord JSON
CVSS
2.3Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.25.6Also 0.26.1CVE List
Published7 Oct 2026Updated 7 Oct 2026CVE List

What fixes it

  • 0.25.6obotCVE List
  • 0.26.1obotCVE List
  • 0.25.6github.com/obot-platform/obot, goGitHubgo get github.com/obot-platform/obot@v0.25.6
  • 0.26.1github.com/obot-platform/obot, goGitHubgo get github.com/obot-platform/obot@v0.26.1

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can restore group memberships just revoked in the identity provider. When overlapping refreshes for the same user commit out of order, stale memberships are persisted and the user retains revoked group-based access for about ten minutes.

Text from CVE List

Affected versions 4

  • obotaffected: 0.25.0 before 0.25.6CVE List
  • obotaffected: 0.26.0 before 0.26.1CVE List
  • github.com/obot-platform/obot, go>= 0.25.0, < 0.25.6GitHub
  • github.com/obot-platform/obot, go= 0.26.0GitHub

References 9